Reintroduce form_action_self() api

This is a partial revert of 38b0212651d368b85858a3820ddbc0150ae32a42.

There are some cases, specifically in the manage_config_* pages, where
form_action_self() is not used directly as a form's action, but passed
to another script to be used for redirections.

Using '' instead of $_SERVER['PHP_SELF'] in this context results in
incorrect redirection (i.e. Mantis will redirect to the user's default
page).

Fixes #16410
Prevent XSS issues relating to PHP_SELF

Selectively porting the security fixes for issue #13191 from dhx's
original commit e679a1c02978ba1b811959dedc358598fc595458, following the
reintroduction of the form_action_self() function in master branch to
fix issue #16410.
Fix application error 0 in manage_config_workflow_page.php

This was due to missing type cast when calling check_checked() in
print_enum_string_option_list().

Fixes #16047
Fix application error 0 in print_project_option_list()

This was due to missing type cast when calling check_selected().

Fixes #16407
Fix whitespace
Workflow thresholds page: fix display of 'who can alter'

When the current project is 'All projects' and the admin changes the
'Who can alter value' threshold (e.g. to 'manager'), the changes are saved
in the config table as expected, but not displayed back properly -
mantis shows the default value of 'administrator' (admin_site_threshold)
instead, giving the impression that the settings have not been saved;
another update will then overwrite the previously saved threshold back
to default.

The projects list in config_get_access() was not properly initialized,
set to an empty array when current project is ALL_PROJECTS.

Fixes #10071
Workflow thresholds page: new set_color() function

Simplify program by moving duplicated code into a new function.

And sorry for the Brits but it's 'color', not 'colour' ;)
Workflow thresholds page: improve html layout

Adding newlines and tabs to make the generated HTML more readable.
Workflow thresholds page: add color highlight for 'who can alter'

Normally on this page, all changes versus system / global defaults are
highlighted in color. This did not work for the access level threshold
of 'Who can alter this value', which are never color-coded regardless of
the actual value.

This commit introduces a new function print_who_can_change() to remove
code duplication.

Fixes #16411
Workflow thresholds page: hide delete button when not needed

The button is now displayed only when there are overrides specific to
the current project.

Fixes #16412
Fixes #16408: config_eval() fails on configs that reference array values

The $g_update_bug_assign_threshold is set to '%handle_bug_threshold%'.
If the value of $g_handle_bug_threshold is set to an array instead of a string/int, a system notice is generated that array to string conversion is done in config_eval().

The fix is to detect the direct assignment case and not use a string replace,
but use normal assignment.  This will make it work for complex types like
arrays.

We still don't support $g_x = '%y%_aaa' where $g_y is not a string or int,
but that shouldn't be an issue.

Signed-off-by: Damien Regad <dregad@mantisbt.org>

Cherry-pick of 1ac581e46e2970475fdbe6434a9ac18a252e9048; Victor's
original commit was amended to follow coding guidelines.